{"id":"ASB-A-150857253", "published":"2020-09-01T00:00:00Z", "modified":"2026-06-10T14:58:40.911641763Z", "aliases":["CVE-2020-0401", "A-150857253"], "details":"In setInstallerPackageName of PackageManagerService.java, there is a missing permission check. This could lead to local escalation of privilege and granting spurious permissions with no additional execution privileges needed. User interaction is not needed for exploitation.", "affected":[{"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"8.0:0"}, {"fixed":"8.0:2020-09-01"}]}], "versions":["8.0"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b"], "severity":"High", "spl":"2020-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["121385483773384471853115903474639452198", "184019182808323809470149447007204861587", "20886215787258101827814598664580995911", "187571104971165644015437199649278715714", "110887872435304263424309036355997997196", "23971151535517674186024780439876312014", "297388453392271801583048335964948395054", "94161684239492038383641357325975761122", "5033414276647347878521861143734219935", "292758487146417046272027740833385359371", "30812556885355799079975849148091184444", "37248816305998331056277029398087325763", "205146389205049220936115294651743896682", "181542654102948766044434891219751375235", "110139631808912567129312820625862970957"], "threshold":0.9}, "id":"ASB-A-150857253-341e5c5a", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b", "target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"277999990525634427442889858236049653453", "length":1591}, "id":"ASB-A-150857253-cb118d3b", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b", "target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java", "function":"setInstallerPackageName"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"8.1:0"}, {"fixed":"8.1:2020-09-01"}]}], "versions":["8.1"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b"], "severity":"High", "spl":"2020-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["121385483773384471853115903474639452198", "184019182808323809470149447007204861587", "20886215787258101827814598664580995911", "187571104971165644015437199649278715714", "110887872435304263424309036355997997196", "23971151535517674186024780439876312014", "297388453392271801583048335964948395054", "94161684239492038383641357325975761122", "5033414276647347878521861143734219935", "292758487146417046272027740833385359371", "30812556885355799079975849148091184444", "37248816305998331056277029398087325763", "205146389205049220936115294651743896682", "181542654102948766044434891219751375235", "110139631808912567129312820625862970957"], "threshold":0.9}, "id":"ASB-A-150857253-112a3108", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b", "target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"277999990525634427442889858236049653453", "length":1591}, "id":"ASB-A-150857253-66ebf69f", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b", "target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java", "function":"setInstallerPackageName"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"9:0"}, {"fixed":"9:2020-09-01"}]}], "versions":["9"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b"], "severity":"High", "spl":"2020-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"function_hash":"277999990525634427442889858236049653453", "length":1591}, "id":"ASB-A-150857253-55b7ad10", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b", "target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java", "function":"setInstallerPackageName"}}, {"deprecated":false, "digest":{"line_hashes":["121385483773384471853115903474639452198", "184019182808323809470149447007204861587", "20886215787258101827814598664580995911", "187571104971165644015437199649278715714", "110887872435304263424309036355997997196", "23971151535517674186024780439876312014", "297388453392271801583048335964948395054", "94161684239492038383641357325975761122", "5033414276647347878521861143734219935", "292758487146417046272027740833385359371", "30812556885355799079975849148091184444", "37248816305998331056277029398087325763", "205146389205049220936115294651743896682", "181542654102948766044434891219751375235", "110139631808912567129312820625862970957"], "threshold":0.9}, "id":"ASB-A-150857253-5f24c2d6", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b", "target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"}}]}}, {"package":{"name":"platform/frameworks/base", "ecosystem":"Android"}, "ranges":[{"type":"ECOSYSTEM", "events":[{"introduced":"10:0"}, {"fixed":"10:2020-09-01"}]}], "versions":["10"], "ecosystem_specific":{"fixes":["https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b"], "severity":"High", "spl":"2020-09-01", "types":["EoP"], "vanir_signatures":[{"deprecated":false, "digest":{"line_hashes":["121385483773384471853115903474639452198", "184019182808323809470149447007204861587", "20886215787258101827814598664580995911", "187571104971165644015437199649278715714", "110887872435304263424309036355997997196", "23971151535517674186024780439876312014", "297388453392271801583048335964948395054", "94161684239492038383641357325975761122", "5033414276647347878521861143734219935", "292758487146417046272027740833385359371", "30812556885355799079975849148091184444", "37248816305998331056277029398087325763", "205146389205049220936115294651743896682", "181542654102948766044434891219751375235", "110139631808912567129312820625862970957"], "threshold":0.9}, "id":"ASB-A-150857253-54d9b8ec", "signature_type":"Line", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b", "target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java"}}, {"deprecated":false, "digest":{"function_hash":"277999990525634427442889858236049653453", "length":1591}, "id":"ASB-A-150857253-d56eb98c", "signature_type":"Function", "signature_version":"v1", "source":"https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b", "target":{"file":"services/core/java/com/android/server/pm/PackageManagerService.java", "function":"setInstallerPackageName"}}]}}], "references":[{"type":"ADVISORY", "url":"https://source.android.com/security/bulletin/2020-09-01"}, {"type":"FIX", "url":"https://android.googlesource.com/platform/frameworks/base/+/40ca8b51fa90457cc49b91eac00636d1626b3a1b"}]}